Matt McGrath — Security coaches

Security programs improve when developers have someone who can help them want to get better, not merely tell them what they did wrong. Matt McGrath joins Chris and Robert to explain the security coach role and how it differs from both a wellness coach and a security champion. He describes the communication skills, technical credibility, and developer empathy that make coaching effective, then examines how coaching fits alongside training and other program controls. The discussion covers meeting cadence, part-time versus dedicated roles, measuring progress, and launching with a small group. Matt’s core advice is to partner with engineering teams and build their capability until they need less direct help from security.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Matt McGrath:
→ Security Coaches episode page

Mentioned in this episode:
→ OWASP Security Champions Guide

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Introducing security coaching
02:20 Matt McGrath’s developer-to-security journey
07:09 What a security coach actually does
10:33 Helping developers choose to improve
13:54 The security coach job description
17:31 Communication, credibility, and technical skills
20:42 How coaching feels from the developer side
24:33 Working toward developer independence
28:24 Part-time and dedicated coaching roles
31:47 Choosing a useful coaching cadence
33:59 Security coaches versus security champions
38:31 How to launch a coaching program
41:49 Partner with engineering teams